@cuongtran001/kanna 1.71.2 → 1.72.0

package/src/server/auth-session-store.adapter.ts

@@ -1,224 +0,0 @@
-import { createHash } from "node:crypto"
-import { mkdir, readFile, rename, writeFile } from "node:fs/promises"
-import path from "node:path"
-import { LOG_PREFIX } from "../shared/branding"
-import { log } from "../shared/log"
-import { isErrnoException } from "../shared/errors"
-import { isJsonArray, isJsonObject, safeJsonParse, type JsonValue } from "../shared/json"
-
-const FILE_VERSION = 1
-const PERSIST_DEBOUNCE_MS = 250
-const PERSIST_DRIFT_MS = 60 * 60 * 1000
-const SWEEP_INTERVAL_MS = 60 * 60 * 1000
-
-export interface PersistedSession {
-  tokenHash: string
-  createdAt: number
-  lastSeenAt: number
-  expiresAt: number
-}
-
-interface SessionsFile {
-  version: number
-  sessions: PersistedSession[]
-}
-
-export interface AuthSessionStore {
-  create(token: string, maxAgeMs: number): PersistedSession
-  validate(token: string): PersistedSession | null
-  touch(token: string, maxAgeMs: number): PersistedSession | null
-  revoke(token: string): void
-  sweep(): void
-  dispose(): Promise<void>
-}
-
-export interface CreateAuthSessionStoreOptions {
-  filePath: string
-  now?: () => number
-  sweepIntervalMs?: number
-}
-
-function hashToken(token: string) {
-  return createHash("sha256").update(token).digest("hex")
-}
-
-function isPersistedSession(value: JsonValue): value is JsonValue & PersistedSession {
-  if (!isJsonObject(value)) return false
-  return typeof value.tokenHash === "string"
-    && typeof value.createdAt === "number"
-    && typeof value.lastSeenAt === "number"
-    && typeof value.expiresAt === "number"
-}
-
-async function loadSessionsFile(filePath: string): Promise<PersistedSession[]> {
-  let text: string
-  try {
-    text = await readFile(filePath, "utf8")
-  } catch (error) {
-    if (isErrnoException(error) && error.code === "ENOENT") return []
-    throw error
-  }
-  if (!text.trim()) return []
-  const parsed = safeJsonParse(text)
-  if (parsed === null) {
-    log.warn(`${LOG_PREFIX} sessions.json is invalid JSON; ignoring.`)
-    return []
-  }
-  if (!isJsonObject(parsed) || !isJsonArray(parsed.sessions)) return []
-  return parsed.sessions.filter(isPersistedSession)
-}
-
-export async function createAuthSessionStore(options: CreateAuthSessionStoreOptions): Promise<AuthSessionStore> {
-  const { filePath } = options
-  const now = options.now ?? (() => Date.now())
-  const sweepIntervalMs = options.sweepIntervalMs ?? SWEEP_INTERVAL_MS
-
-  await mkdir(path.dirname(filePath), { recursive: true })
-  const initialSessions = await loadSessionsFile(filePath)
-  const sessions = new Map<string, PersistedSession>()
-  const lastPersistedExpiry = new Map<string, number>()
-  for (const session of initialSessions) {
-    if (session.expiresAt > now()) {
-      sessions.set(session.tokenHash, session)
-      lastPersistedExpiry.set(session.tokenHash, session.expiresAt)
-    }
-  }
-
-  let pendingPersist: ReturnType<typeof setTimeout> | null = null
-  let activeWrite: Promise<void> | null = null
-  let writeAgain = false
-
-  async function writeFileAtomic() {
-    const payload: SessionsFile = {
-      version: FILE_VERSION,
-      sessions: Array.from(sessions.values()),
-    }
-    const tmpPath = `${filePath}.tmp`
-    await writeFile(tmpPath, `${JSON.stringify(payload, null, 2)}\n`, "utf8")
-    await rename(tmpPath, filePath)
-    for (const session of payload.sessions) {
-      lastPersistedExpiry.set(session.tokenHash, session.expiresAt)
-    }
-    for (const tokenHash of [...lastPersistedExpiry.keys()]) {
-      if (!sessions.has(tokenHash)) lastPersistedExpiry.delete(tokenHash)
-    }
-  }
-
-  async function runWrite() {
-    do {
-      writeAgain = false
-      try {
-        await writeFileAtomic()
-      } catch (error) {
-        log.warn(`${LOG_PREFIX} Failed to persist sessions.json:`, String(error))
-      }
-    } while (writeAgain)
-    activeWrite = null
-  }
-
-  function schedulePersist() {
-    if (pendingPersist) return
-    pendingPersist = setTimeout(() => {
-      pendingPersist = null
-      if (activeWrite) {
-        writeAgain = true
-        return
-      }
-      activeWrite = runWrite()
-    }, PERSIST_DEBOUNCE_MS)
-  }
-
-  async function flushPersist() {
-    if (pendingPersist) {
-      clearTimeout(pendingPersist)
-      pendingPersist = null
-      activeWrite = activeWrite ?? runWrite()
-    }
-    if (activeWrite) await activeWrite
-  }
-
-  function shouldPersistTouch(tokenHash: string, expiresAt: number) {
-    const last = lastPersistedExpiry.get(tokenHash)
-    if (last === undefined) return true
-    return Math.abs(expiresAt - last) >= PERSIST_DRIFT_MS
-  }
-
-  function create(token: string, maxAgeMs: number): PersistedSession {
-    const tokenHash = hashToken(token)
-    const timestamp = now()
-    const session: PersistedSession = {
-      tokenHash,
-      createdAt: timestamp,
-      lastSeenAt: timestamp,
-      expiresAt: timestamp + maxAgeMs,
-    }
-    sessions.set(tokenHash, session)
-    schedulePersist()
-    return session
-  }
-
-  function validate(token: string): PersistedSession | null {
-    const tokenHash = hashToken(token)
-    const session = sessions.get(tokenHash)
-    if (!session) return null
-    if (session.expiresAt <= now()) {
-      sessions.delete(tokenHash)
-      schedulePersist()
-      return null
-    }
-    return session
-  }
-
-  function touch(token: string, maxAgeMs: number): PersistedSession | null {
-    const tokenHash = hashToken(token)
-    const session = sessions.get(tokenHash)
-    if (!session) return null
-    const timestamp = now()
-    if (session.expiresAt <= timestamp) {
-      sessions.delete(tokenHash)
-      schedulePersist()
-      return null
-    }
-    const next: PersistedSession = {
-      ...session,
-      lastSeenAt: timestamp,
-      expiresAt: timestamp + maxAgeMs,
-    }
-    sessions.set(tokenHash, next)
-    if (shouldPersistTouch(tokenHash, next.expiresAt)) {
-      schedulePersist()
-    }
-    return next
-  }
-
-  function revoke(token: string) {
-    const tokenHash = hashToken(token)
-    if (sessions.delete(tokenHash)) {
-      schedulePersist()
-    }
-  }
-
-  function sweep() {
-    const cutoff = now()
-    let changed = false
-    for (const [tokenHash, session] of sessions) {
-      if (session.expiresAt <= cutoff) {
-        sessions.delete(tokenHash)
-        changed = true
-      }
-    }
-    if (changed) schedulePersist()
-  }
-
-  const sweepHandle = setInterval(sweep, sweepIntervalMs)
-  if (typeof sweepHandle === "object" && sweepHandle !== null && "unref" in sweepHandle) {
-    sweepHandle.unref?.()
-  }
-
-  async function dispose() {
-    clearInterval(sweepHandle)
-    await flushPersist()
-  }
-
-  return { create, validate, touch, revoke, sweep, dispose }
-}

package/src/server/auth-session-store.test.ts

@@ -1,94 +0,0 @@
-import { afterEach, describe, expect, test } from "bun:test"
-import { createHash } from "node:crypto"
-import { mkdtemp, readFile, rm } from "node:fs/promises"
-import { tmpdir } from "node:os"
-import path from "node:path"
-import { createAuthSessionStore } from "./auth-session-store.adapter"
-
-const tempDirs: string[] = []
-
-afterEach(async () => {
-  await Promise.all(tempDirs.splice(0).map((dir) => rm(dir, { recursive: true, force: true })))
-})
-
-async function makeFilePath() {
-  const dir = await mkdtemp(path.join(tmpdir(), "kanna-sessions-"))
-  tempDirs.push(dir)
-  return path.join(dir, "sessions.json")
-}
-
-const DAY_MS = 86_400_000
-
-describe("auth-session-store", () => {
-  test("persists only the sha256 hash of the token", async () => {
-    const filePath = await makeFilePath()
-    const store = await createAuthSessionStore({ filePath })
-    store.create("super-secret-token", DAY_MS)
-    await store.dispose()
-
-    const text = await readFile(filePath, "utf8")
-    expect(text).not.toContain("super-secret-token")
-    const expectedHash = createHash("sha256").update("super-secret-token").digest("hex")
-    expect(text).toContain(expectedHash)
-  })
-
-  test("hydrates persisted entries on construction", async () => {
-    const filePath = await makeFilePath()
-    const first = await createAuthSessionStore({ filePath })
-    first.create("token-a", DAY_MS)
-    await first.dispose()
-
-    const second = await createAuthSessionStore({ filePath })
-    expect(second.validate("token-a")).not.toBeNull()
-    expect(second.validate("missing")).toBeNull()
-    await second.dispose()
-  })
-
-  test("expired entries are dropped on validate and sweep", async () => {
-    const filePath = await makeFilePath()
-    let now = 1_000
-    const store = await createAuthSessionStore({ filePath, now: () => now })
-    store.create("token-x", 100)
-    expect(store.validate("token-x")).not.toBeNull()
-
-    now = 5_000
-    expect(store.validate("token-x")).toBeNull()
-
-    store.create("token-y", 100)
-    now = 100_000
-    store.sweep()
-    expect(store.validate("token-y")).toBeNull()
-    await store.dispose()
-  })
-
-  test("touch shifts expiresAt forward and survives reload", async () => {
-    const filePath = await makeFilePath()
-    let now = 1_000
-    const first = await createAuthSessionStore({ filePath, now: () => now })
-    first.create("token-z", DAY_MS)
-
-    now = 1_000 + 12 * 60 * 60 * 1000
-    const touched = first.touch("token-z", DAY_MS)
-    expect(touched).not.toBeNull()
-    expect(touched!.expiresAt).toBe(now + DAY_MS)
-    await first.dispose()
-
-    const second = await createAuthSessionStore({ filePath, now: () => now })
-    const reloaded = second.validate("token-z")
-    expect(reloaded).not.toBeNull()
-    expect(reloaded!.expiresAt).toBe(now + DAY_MS)
-    await second.dispose()
-  })
-
-  test("revoke removes entries from disk", async () => {
-    const filePath = await makeFilePath()
-    const store = await createAuthSessionStore({ filePath })
-    store.create("token-r", DAY_MS)
-    store.revoke("token-r")
-    await store.dispose()
-
-    const reloaded = await createAuthSessionStore({ filePath })
-    expect(reloaded.validate("token-r")).toBeNull()
-    await reloaded.dispose()
-  })
-})